PseudoSigner 01 FSG 10 Anorganix

Hunt Hypothesis

This hypothesis targets the execution of the PseudoSigner 01 FSG 10 Anorganix binary, a known tool used to generate fake digital signatures for code signing, which adversaries employ to bypass trust controls and establish persistence. Proactively hunting for this indicator in Azure Sentinel allows the SOC to identify compromised endpoints or staging environments where attackers are preparing malicious payloads before they are deployed or executed in production systems.

YARA Rule

rule _PseudoSigner_01_FSG_10_Anorganix: PEiD
{
    strings:
        $a = { 90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 BB D0 01 40 00 BF 00 10 40 00 BE 90 90 90 90 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 FC B2 80 A4 6A 02 5B E9 }
    condition:
        $a at pe.entry_point

}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A developer or DevOps engineer uses a custom Python or Node.js script to programmatically generate self-signed certificates or mock digital signatures for local testing environments (e.g., using pyOpenSSL or node-forge), where the binary or script contains the specific byte patterns or string literals targeted by the YARA rule.

  • Filter/Exclusion: Exclude processes running from standard development directories (e.g., C:\Users\*\AppData\Local\Temp\, C:\dev\, C:\projects\) or exclude processes with command lines containing keywords like test, mock, local, or dev when the parent process is a known IDE or runtime (e.g., python.exe, node.exe, code.exe).

• Scenario: An enterprise application installer or updater (e.g., Adobe Creative Cloud, Microsoft Office, or a custom internal tool) uses a temporary helper executable to verify or create a signature during the installation phase, which may reside in a temporary folder and match the YARA pattern due to embedded libraries or specific code structures.

  • Filter/Exclusion: Exclude files located in standard temporary directories (%TEMP%, C:\Windows\Temp, C:\Users\*\AppData\Local\Temp) if the parent process is a known installer or setup utility (e.g., msiexec.exe, setup.exe, install.exe) and the file extension is .exe or .dll.

• Scenario: A scheduled task or service (e.g., a backup agent, log rotation script, or monitoring agent like Datadog, New Relic, or Splunk Universal Forwarder) periodically executes a small utility binary that performs cryptographic operations or signature verification, which may contain the specific code patterns identified by the YARA rule.

  • Filter/Exclusion: Exclude processes whose names